Data Processing Agreement

Parties

This agreement is an annex to section 5 of the General Terms and Conditions, with the content required by GDPR Art. 28(3). The landlord accepts it by creating a workspace and accepting the Terms; no separate signature is needed. The Hungarian version prevails.

Controller: the landlord using a workspace in Rentkey (an individual, a sole trader or a company) (the Landlord).

Processor: WebWave Media Kft. (registered office: Táborföld út 6., 2096 Üröm, Hungary; company registration number: Cg. 13-09-208650; tax number: 28827801-2-13) (Rentkey).

1. Subject of the agreement

1.1. Rentkey processes the personal data recorded in the Landlord's workspace solely to provide the Rentkey service, on behalf of the Landlord and according to its instructions.

1.2. The Landlord's instructions are its use of Rentkey's features (for example entering data, preparing a contract, sending a notification, deleting data), the Terms and this agreement. If Rentkey considers an instruction unlawful, it informs the Landlord without delay.

1.3. This agreement does not cover data for which Rentkey is an independent controller: user account data, the tenant's own Rentkey Passport and the evidence in it, billing data and security logs. The Privacy Notice applies to those.

2. Nature of the processing

Data subjects: tenants and prospective tenants, applicants, people living with the tenant, owners, the Landlord's team members and attorneys-in-fact, service providers and tradespeople, referees.

Categories of data: identification and contact data, personal data needed for the contract (place and date of birth, mother's name, ID document number, address), bank account number, lease and payment data, meter readings, photos of the home and its condition, messages and attachments, maintenance requests, viewing appointments, signature log data.

Special category data: we process no special category data in the Landlord's workspace. The tenant's identity check (Didit) belongs to the tenant's own Passport, not to the workspace; the Landlord only sees the result (verified / not verified).

Operations: storage, organisation, display to authorised users, producing documents (contract, protocol, settlement), sending notification e-mails, export, deletion.

Duration: while the workspace exists, then as set out in section 8.

3. Rentkey's obligations

a) Rentkey processes personal data only on the Landlord's documented instructions, unless EU or Hungarian law requires otherwise; in that case it informs the Landlord in advance unless the law prohibits this.

b) It ensures that its staff with access to the data are bound by confidentiality.

c) It takes the security measures in section 4.

d) It engages further processors only as set out in section 5.

e) With its features (data download, correction, deletion) and, where needed, through support, it helps the Landlord respond to data subject requests.

f) It helps the Landlord meet its obligations on security, breach notification and, where needed, impact assessment.

g) When the agreement ends it acts as set out in section 8.

h) At the Landlord's request it provides the information needed to demonstrate compliance and allows audits as set out in section 9.

4. Data security

4.1. Rentkey applies at least the following measures: encrypted transmission (HTTPS/TLS); storage of the database and files in the European Union (Frankfurt), encrypted; row-level access control under which every user reaches only the data of their own workspace, according to the role the Landlord gave them; two-step verification, optional for users and mandatory in the support back office; passwords stored only in hashed form; logging of support access and important actions; regular backups.

4.2. The Landlord is responsible for giving access to its workspace only to authorised people and for setting roles no wider than needed.

5. Further processors

5.1. The Landlord gives general authorisation for Rentkey to engage the following further processors:

Supabase Inc. – database, file storage, sign-in; data location: EU (Frankfurt).

Vercel Inc. – running the website and the app; EU and USA.

RackForest Zrt. (Victor Hugo utca 18–22, 1132 Budapest) – delivery of notification e-mails; Hungary (EU).

OpenAI, L.L.C. / OpenAI Ireland Ltd., or Anthropic PBC – Legal Assistant: the question and, if the Landlord asks about a contract, its data; USA.

5.2. Transfers to the USA rely on the EU–US Data Privacy Framework (where the provider is certified), otherwise on the European Commission's standard contractual clauses.

5.3. Before engaging or replacing a processor, Rentkey notifies the Landlord by e-mail or in the app at least 15 days in advance. The Landlord may object on reasonable grounds within that period. If the parties do not agree, the Landlord may terminate the service with immediate effect before the change takes effect, without a claim for a refund.

5.4. Rentkey binds further processors to obligations essentially the same as those in this agreement and is liable to the Landlord for their performance.

5.5. A provider the Landlord connects to its workspace itself (for example its own Google Drive or OneDrive storage, an external listing portal, a calendar) is not a further processor. The Landlord has its own relationship with such providers.

6. Personal data breach

6.1. Rentkey notifies the Landlord of a personal data breach it becomes aware of without undue delay, within 48 hours at the latest, at the e-mail address of the workspace owner.

6.2. The notification contains, as far as already known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and proposed, and a contact person. Rentkey adds what is not yet known later.

6.3. Notifying the authority (NAIH) and the data subjects is the Landlord's task; Rentkey helps with the information it has.

7. Data subject requests

If a data subject contacts Rentkey directly about workspace data, Rentkey forwards the request to the Landlord without delay and replies on the merits only on the Landlord's instruction or where the law requires it.

8. End of the agreement, fate of the data

8.1. The agreement ends when the workspace ends.

8.2. When the workspace is deleted, Rentkey deletes the data. If signed contracts, protocols or financial records belong to the workspace, Rentkey keeps them archived, without access, for the statutory retention period (5 years from the end of the last lease, 8 years where money changed hands), then deletes them. Tenants can still reach the copy of their own contract during that time.

8.3. The Landlord may download its data and documents at any time before deletion.

8.4. Deleted data disappears from backups as the backups expire, within 30 days at the latest.

9. Audits

The Landlord may ask in writing, at most once a year, for information on compliance with this agreement. Rentkey answers primarily in writing and with the documents it has. An on-site audit may take place after prior agreement, during working hours, at the Landlord's cost and while protecting other customers' data.

10. Other provisions

10.1. The parties' liability is governed by the liability rules of the Terms and GDPR Art. 82.

10.2. Where the Terms and this agreement differ on data processing, this agreement prevails.

10.3. Rentkey may amend this agreement under the rules for amending the Terms; changes to the list of further processors are governed by section 5.3.

10.4. Governing law: Hungarian law.